PostNuke Unauthenticated User Login Vulnerability
BID:3435
Info
PostNuke Unauthenticated User Login Vulnerability
| Bugtraq ID: | 3435 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 13 2001 12:00AM |
| Updated: | Oct 13 2001 12:00AM |
| Credit: | |
| Vulnerable: |
PostNuke Development Team PostNuke 0.64 PostNuke Development Team PostNuke 0.63 PostNuke Development Team PostNuke 0.62 |
| Not Vulnerable: | |
Exploit / POC
PostNuke Unauthenticated User Login Vulnerability
The attacker must base64 encode the string containing the malformed
User ID, Username and Password combination. The unencoded string would be in the following format (with USERID and USERNAME appropriately replaced):
USERID:USERNAME:' or uname='USERNAME
This encoded string would then be passsed to the article.php script by requesting a URL of the following form (this could be trivially accomplished from a web browser):
http://targethost/article.php?save=1&sid=20&cookieusrtime=160000&user=USERID:encodedstring
Where encodedstring is the previously described base64 encoded string. Base64 encoding can be trivially accomplished with the use of any of a number of simple utilities.
The attacker must base64 encode the string containing the malformed
User ID, Username and Password combination. The unencoded string would be in the following format (with USERID and USERNAME appropriately replaced):
USERID:USERNAME:' or uname='USERNAME
This encoded string would then be passsed to the article.php script by requesting a URL of the following form (this could be trivially accomplished from a web browser):
http://targethost/article.php?save=1&sid=20&cookieusrtime=160000&user=USERID:encodedstring
Where encodedstring is the previously described base64 encoded string. Base64 encoding can be trivially accomplished with the use of any of a number of simple utilities.
References
PostNuke Unauthenticated User Login Vulnerability
References:
References:
- PostNuke Product Page (PostNuke)
- Project: PostNuke Content Management System (SourceForge)